CVE-2026-49864

HighCVSS 8.6

Published: 13/08/2026(UTC)Updated: 18/08/2026(UTC)Translated: 14/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

25th percentile - higher than 25% of all known CVEs

Summary

wetty prior to version 3.0.4 decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string. Any output rendered by the victim containing \x1b[5i...:...\x1b[4i can run script in the wetty origin and type attacker-chosen keystrokes into the victim's SSH session.

Risk Assessment

The risk includes script execution in the wetty context and potential takeover of the victim's SSH session, leading to full system compromise.

Recommendation

Immediately upgrade wetty to version 3.0.4 or later.

Original NVD description (English source)

wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the victim renders - a `cat`'d file, a tailed log, an SSH MOTD, a `curl` response - that contains `\x1b[5i...:...\x1b[4i` runs script in the wetty origin and types attacker-chosen keystrokes into the victim's SSH session. Version 3.0.4 fixes the issue.